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We study eavesdropping in quantum key distribution with the six state protocol, when the signal 
states are mixed with white noise. This situation may arise either when Alice deliberately adds noise 
to the signal states before they leave her lab, or in a realistic scenario where Eve cannot replace the 
noisy quantum channel by a noiseless one. We find Eve's optimal mutual information with Alice, 
for individual attacks, as a function of the qubit error rate. Our result is that added quantum noise 
can make quantum key distribution more robust against eavesdropping. 



PACS numbers: 03.67.-a,03.67.Dd,42.50.EX 

I. INTRODUCTION 

In quantum cryptography - or, more precisely, quan- 
tum key distribution - a secret key is established between 
two trusted parties (Alice and Bob), by employing certain 
quantum states as signals, and suitable measurements 
In a typical implementation, polarized photons are sent 
from Alice to Bob along an optical fiber 0]. An eaves- 
dropper (Eve) is usually assumed to have every possible 
power that is compatible with the laws of quantum me- 
chanics. This power is not necessarily realistic, with re- 
spect to existing tools and technology. In particular. Eve 
is supposed to be able to replace the quantum channel 
(i.e. the optical fiber in our example given above), which 
in reality always introduces some noise, by a noiseless 
fiber. Even though this assumption is compatible with 
quantum mechanics, it is too restrictive from a realist's 
point of view. 

In this paper, we will assume that Eve does not possess 
a noiseless fiber. Thus, the quantum states will experi- 
ence noise in transit from Alice to Bob. We will consider 
white noise, where the noise parameter p describes the 
best existing fiber that Eve can possibly get hold of. Our 
results also hold for the scenario where Alice deliberately 
adds noise to the state before sending it out of her labo- 
ratory, and the quantum channel is noiseless. 

Note that we are considering additional noise at the 
quantum level. A related question has been studied in Q: 
there, it has been shown that if one of the parties (Alice 
or Bob) adds some noise to their classical measurement 
data before error correction, then the BB84 [Ij, B92 
and six state protocol 0, 0] are more robust with respect 
to quantum noise, i.e. the secret key rate is non-zero up 
to higher values of the quantum bit error rate. Adding 
noise at the quantum level, i.e. before the measurement, 
will also lead to additional noise at the classical level. In 
this sense our scenario should lead, at least qualitatively, 
to a similar result as shown in 

The aim of our paper is to present an intuitive under- 
standing for the counter-intuitive fact (shown in [1]) that 
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noise may help the trusted parties to improve the perfor- 
mance of a quantum cryptographic protocol. We will de- 
rive the optimal mutual information that Eve can obtain, 
when using individual attacks on noisy quantum signals, 
and compare it to the mutual information achievable by 
eavesdropping on pure states. One expects that Alice 
and Bob, but also Eve, will lose some information, due 
to the additional noise. It is not evident, however, how 
the relation between the two mutual information curves 
(Alice and Bob versus Alice and Eve ) changes, when the 
noise increases. 

In this paper we will discuss the six state protocol 
with additional (equal) noise on all signal states. The 
six signal states of the protocol with pure states are 
{|0,), |0j,), \ly), |0,), where \0^) and with 

a = x,y,z denote the eigenstates of Pauli operator ctq. 
Here, the states |0a) symbolize the classical bit value 0, 
and \la) represents the classical bit value 1. 

II. EAVESDROPPING ON MIXED STATES 

In the six state protocol with mixed states Alice sends 
instead of pure states one of the following six mixed states 
(either deliberately, or due to unavoidable noise in the 
transmission channel): 

p' = (i-p)|z)(z| + |i, ie{0„,U} (1) 

with a — x,y, z. The parameter p describes the amount 
of noise, with < p < 1. Here, we assume the noise to 
be equal in all bases, i.e. we study the depolarising chan- 
nel. (In a more general model, polarization dependent 
noise could be treated in an analogous way, by letting pa 
depend on a = x, y, z.) 

For the eavesdropping strategy we assume that Eve is 
restricted to interfering separately with each of the sin- 
gle systems sent by Alice (i.e. individual attack). In this 
class of attacks she attaches to each qubit an independent 
probe which is initially in the state \X) and applies some 
unitary transformation. The dimension of the probes and 
the interaction are in principle arbitrary, but in Q it has 
been shown that the most general unitary eavesdropping 
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attack on a d-dimensional signal state needs only (P lin- 
early independent ancilla states of Eve. (This argument 
also holds when the signal states are mixed, as the uni- 
tary transformation of the basis states already uniquely 
defines the transformation of any superposition, due to 
linearity, and thus also of a mixture of projectors onto 
superpositions of basis states.) Thus, it is enough for 
Eve to use two qubits for her probe states. 

The most general unitary transformation U that Eve 
can design is defined via its action on the basis states 
(where we use for the computational basis the notation 
|0) = |0,) and |1) = 

U\0)\X)=VT^mA)+VD\l)\B), (2a) 
U\1)\X) =VT~^\1)\C)+Vd\0)\D), (2b) 

where D is called the disturbance, with < D < ^. 
Eve's normalized probes after interaction are \A), \B), 
|C), and \D). They have to be chosen such that C/ is a 
unitary operator. 

The quantum bit error rate in the z-basis is denoted as 
Qz, and given as the fraction of original signals |0)(|1)) 
sent by Alice, but interpreted as |1)(|0)) by Bob, namely 

Q, = i(0|pf|0) + i(l|p-|l), (3) 

where pf and Pg are the states that Bob receives when 
Alice sends |0) and |1), respectively. We define Qx.y in 
an analogous way for the x and y-basis. 

As we assume the noise to be uniform, a quantum bit 
error rate that is basis-dependent indicates the presence 
of an eavesdropper. We therefore suppose that Eve uses 
a strategy that produces the same quantum bit error rate 
in the three different bases, i.e. 

- 0. - - Qy (4) 

It can be easily verified that the relationship between 
the quantum bit error rate Q and D is 

Q = D{l-p) + ^. (5) 

Additionally, we restrict Eve to attack in such a way that 
the two terms of Q are identical, i.e. 

(0K|0) = (iK|i), (6) 

which can be tested by Alice and Bob, by comparing a 
part of their bit string for the z-basis. Again, an anal- 
ogous requirement has to hold in the other two bases, 
too. 

Equations ^ and (O, together with the unitarity of 
U lead to the four following conditions for Eve's states: 



{B\D) = 0, (7a) 

Re{A\C) = Hi^, (7b) 

{A\B) + {D\C) = 0, (7c) 

{A\D) + {B\C) = 0. (7d) 



Note that the quantum bit error rate Q only depends 
on the scalar product between \A) and |C). Eve's two- 
qubit states can be written as an expansion of four basis 
vectors with complex coefficients. As explained above, 
Eve's states only need to be four-dimensional. We have 
the freedom to choose \B) = |00). Equation (|7a|) allows 
to assign \D) one of the other three basis vectors, e.g., 
\D) — 1 11). The general expansion for the normalized 
vectors \A) and |C) is 

\A) = + /3a|10) + 7a|01) + J^|ll), (8a) 

with + + |^^|2 + |^^|2 ^ 1 ^ (8b) 

and 

|C) =ac|00)-H/?c|10>+7c|01)-f <5c|ll), (9a) 

with |acP + |/?c|' + l7c|' + |^cP = l. (9b) 

We have to determine the free parameters a a, i^a and 
qCj-'-j'^c such that Eve's transformation is optimized. 
As a figure of merit we will calculate the mutual infor- 
mation between Eve and Alice, and optimize Eve's trans- 
formation such that she acquires the maximal mutual in- 
formation. 



III. RESULTS 

The mutual information measures the information that 
two parties share. Here the parties have variables X, Y 
that can take values x, y, respectively. The mutual infor- 
mation is defined @ as 

jXY ^ ^p(x,y) log p{y\x) - ^p(y) logp(?/), (10) 
x,y y 

where p{x, y) is the joint probability to find x and y, and 
p{y\x) is the conditional probability of ?/, given x. All 
logarithms are taken to base 2. 

Eve wishes to retrieve the maximal information, 
i.e. she has to choose the optimal coefficients 
aA,c, Pa,c, 1a,g, 5a,c, for fixed p and Q. The fuU prob- 
lem can be simplified with the following argument: As 
mentioned above, for a fixed noise parameter p the quan- 
tum bit error rate Q only depends on the real part 
of the overlap between \A) and |C), see equation ([7b}. 
Therefore, Eve is free to choose those states on which 
Q does not depend in such a way that her informa- 
tion is maximal, as long as the constraints given in 
equations ([7a|) -(|7d |) are fulfilled. Thus, Eve will choose 
her ancilla states orthogonal (whenever possible), i.e. 
{A\B) = {B\C) = {A\D) = {D\C) = 0, which corre- 
sponds to aA — 5a — OLQ = (5c = 0. One realizes by 
looking at equation (Pa|) and (j2bp that in this way Eve's 
probe states are made as distinguishable as possible (for 
given (A|C) 7^ 0). The best measurement for the two 
remaining non-orthogonal states \A) and |C) is rank one 
and orthogonal [1, Q . 
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With the above definition ([10)) for the mutual informa- 
tion besides the exphcit expansions of Eve's states as in 
([8a| . ([9a|) . the information that Eve acquires is 



jAE _ 



1 + - — 

2^ l-p 



Q 



(l-f)l/3Ap + fl/?cP,fl/3Ap + (l-|)|/3cl^ 



(l-f)l7^P + fl7cP,|l7Ap + (l 



(- 



1 _ P ^ 
2 ' 2 



)l7cp]} 
(11) 



l-p 

where we used the definition 

T[x,y] = xlogx + ylogy - {x + y) log{x + y) . (12) 

We used the method of Lagrange multiphers for the op- 
timization problem. Some details and the equations to 
be solved are given in the Appendix. 

As sketched in the Appendix, we arrive at |/3cP = 
1 — Thus, we find that the maximal mutual infor- 

mation between Alice & Eve is 

,1-f-Q, 



/^^ = l + (- 



1-p 



{((l-p)l/9^ 



|)log((l-p)|/3^| 



-) 



+ ( 



(1- 

Q 



|-(l-p)|/3^P)log(l-| 



l-p 



log 



P 



(l-f)log(l-f)}, 



{l-p)\f3A\')} 

(13) 



where 



- i(l + T^^ViQ - f )(2 - 3Q - i) ) .(14) 

Obtaining the mutual information between Alice and 
Bob is an easy task. From the definition of the mutual 
information we find 



/^^ = l + giogQ + (l-Q)log(l-Q). 



(15) 



One easily confirms that in the absence of white noise, 
i.e. for p — 0, the mutual information functions reduce 
to the noiseless case described in 5] . 

We have plotted the mutual information curves I^^ 
and I^^ as a function of the qubit error rate Q in Fig. 
1, for an example with p = 0.05. Note that for p 
both information curves start at a non-zero value for Q, 
as we have Q > p/2 from equation ((5]). In comparison to 
the noiseless case the mutual information between Alice 
& Eve is lower than without noise. As p increases, /"^^ 
decreases. On the other hand, for increasing p, the mu- 
tual information curve for Alice & Bob starts at higher 
values for Q, but otherwise remains invariant. Intuitively 
speaking, both the trusted and untrusted parties undergo 
some degradation of their information, due to the noise. 
Which consequence does this have for the creation of a 
secret key? 



Let us turn our attention to the crossing point between 
the two mutual information curves. A secret key can be 
established if I^^ - /^^ > [3, i.e. for values of Q 
which are smaller than the value for the crossing point. In 
Fig. 1 we observed that for one example of non-zero p the 
crossing-point moves towards a larger Q. We therefore 
studied the Q- value for the crossing-point as a function of 
p. The result is shown in Fig. 2. Remember the relation 
between qubit error rate Q, disturbance D and noise p, 
given in equation ([5|). One might expect that the cross- 
ing point of the two information curves obeys this linear 
dependence, i.e. Qcross ~ Dcross{l —p) +p/2; this is the 
dashed line in Fig. 2. However, the true value for the 
crossing point lies above that straight line. Thus, as p in- 
creases, the crossing point moves to a higher quantum bit 
error rate than expected from the additional noise. So, 
by adding noise to the quantum data the secure parame- 
ter range of Q will increase. In other words, the six state 
protocol with mixed states is more robust against eaves- 
dropping than the six state protocol with pure states. 

In summary, we have studied individual eavesdropping 
attacks on the six state protocol with added white noise. 
We found the optimal mutual information between Eve 
and Alice, for a fixed amount of noise, as a function of 
the qubit error rate. We showed that the crossing point 
between the mutual information curves for Alice/Bob 
and Alice/Eve (Csiszar-Korner threshold) moves to a 
qubit error rate that is higher than expected from the 
noise alone. Thus, we gave a simple explanation for the 
counter-intuitive fact that added noise may improve the 
robustness of a quantum key distribution protocol. Our 
results are of importance in a realistic scenario, where 
the eavesdropper does not have a noiseless fiber avail- 
able. Alternatively, Alice can deliberately add noise to 
the signal states. In this paper, we have focused on a 
particular QKD protocol and a particular type of noise. 
As an outlook, it would be interesting to study other 
protocols, and/or other types of noise. 
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Note that because of the unphysical global phase we have 
the freedom to choose (3a and (3c real. Using the La- 
grange multiplier method we then write the Lagrangian 
L as 



/Li 



/ for six pure states 

jAB mixed states 

— - — Optimal /'^^ for six pure states 

— — — Optimal for six mixed states 

FIG. 1. Mutual information between Alice & Bob and Alice &c 
Eve for six pure and six mixed state cases, as a function of qubit error 
rate (Q) when noise parameter is p — 0.05. 



Crossing Point (Q) 




0.6 .£ 



FIG. 2. The solid line is the value of Q for the crossing point of 
/'^^ and , as a function of the noise parameter p. The dashed line 
is the straight line that corresponds to equation when D— 0.15637. 



IV. APPENDIX 

Here we briefly explain our method for obtaining the 
optimized /^^. First, we redefine the complex coeffi- 
cients Pa,Ci"/a,c in polar coordinates: 



f3A 

(3c 

lA 
IC 



' 1A 



exp(i$T,^), 
exp(i$^c). 



(16) 

(17) 
(18) 

(19) 



/^^ + Ai.gi + A2.g2 + A353, 



(20) 



where (71,32 and 33 are the constraints (rfb ]) . (|8b|) and ([9b|) . 
The derivative dL = yields the following system of 
equations: 



91 = r^^rp^ + r^^r^c cos($^^ 
2(1 -2Q) 



) 
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2-p~2Q 

r ' 
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0, 



53 = rf3c +rj^ -1 = 0, 



' 7A ' 7C 



^/3.{( 



sin($. 

1-f-Q 
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(22) 
(23) 
(24) 



)((1 - log Af2 + ? logMe 

1 — p I I 



- log(M2 + Me)) + 2A2} + Air/3e = 0, (25) 



-i-^)(^logAf2 + (l-^)logM6 
1 — p 2 z 



log(M2 + Me)) -f 2A3} + Air^^, = 0, 
,1 



(26) 
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(28) 



Here, A/i, M4 and M5, Mg are the probabilities that 
Eve detects |00), |10), |01) and |11) while Alice sends po 
and pi , respectively. The Mi are defined as 



A/i = A/s 
M2 
A/3 
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(29) 



It is not straightforward to extract the solution from 
this set of equations. We will follow a strategy based 
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on analytical and numerical methods. Due to equa- 
tion ([M)) there are two possible solutions, which are 
cos($^^ — — 1 and cos(<i>-y^ — $7^) = —1 (as r^^ 

and cannot be zero). 

Let us first assume the option cos($-y^ — ^-y^) = 1. 
Note that in this case the set of equations (21) - (28) 
is invariant under the simultaneous exchange rp^ ^ r^^ 
and rp^ r^^. As we can see from equation (11), the 
mutual information function is also symmetric under this 
exchange. Now, we combine the set of the equations (|2T|) - 
([28|) to one joint equation in terms of p, Q and rp^'^. The 
task is to find all roots for r^j^^. From equations (22) 
and (23) we have r^^^ = 1 — r^^^ and r^^^ = 1 — r/s^^. 
This fact, together with the symmetry mentioned above, 
means that there has to be an even number of roots for 
^/3a ^ (if 011*3 finds a solution for r^^ , then 1 — is also 
a solution). Numerically (by plotting the joint equation 
in terms of rp^'^) we show that for different p and Q 
there are always exactly two roots. Analytically, r^^^ ~ 
1 — r_a^^ is a possible solution for the equations ([22]) - ((28)) . 
By inserting this expression for r^^ ^ as well as r^^ ^ and 
r^c^ (see above) into (|2T|) we find two solutions for r^j^^ 
which are parametrized in terms of p and Q. One of them 
is the equation (jl4p . already given in the text, and the 
other one is 

rp.' = \M' = - T3i3QV(Q-!)(2-3Q-|)). 

(30) 



Both of them lead to the same mutual information (this 
is clear from the symmetry, as explained above). Hence, 
we arbitrarily chose the one given in equation (fT4|) . Com- 
paring analytical and numerical results made us sure that 
rp^ ^ = 1 — Tf}^ ^ is the unique relation between rp^ ^ and 

For the case cos($y^ — ^y^) = — 1, we repeat the above 
process. However, equation (j2ip is now not symmetric 
under the exchange rp^ <-!■ r-y^ and rp^ <-> r-y^ . If we 
plot the joint function for equations pT|) - (|28p in terms 
of r^^^, we just find one root, and thus just expect one 
solution of the set of equations. Analytically we obtain 
r^p^ = as a possible solution. This leads to the 

following mutual information between Alice and Eve: 



Comparing the equations (jl3p and ([31]) analytically, we 
see that for all p and Q the function in (fT3|) is bigger 
than (pij) . Therefore, equation (|13p is the optimal mutual 
information. 
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